Privacy and your data
Plain-language notice. This page describes how the games handle player data today. It has not had a formal legal review; if a review or a change in practice alters anything, this page is updated and the date below changes.
Who we are and how to reach us
FunPlayLab is run by Lumiora Studio: the catalog at play.funplaylab.com and each game's own funplaylab.com address. For privacy questions or requests that the controls below cannot handle (for example a suspended account), use the operator's published contact: privacy@funplaylab.com
What we collect
Jobring, Confetti Pop and Tickdown do not use server accounts. Hueless and Leakproof can be played locally; their online scores/replays need a login. Dawnblade requires an account. The collection uses GitHub or LINUX DO. When you sign in we store:
- Your identity at the provider: the provider name, your numeric account ID there, your username, display name, avatar link and, for LINUX DO, your trust level. We do not ask for or store your password or email address. The provider access token is used for profile lookup and is not retained.
- Login sessions: a scrambled (hashed) copy of your login cookie and its expiry date. One login works on every game because the cookie belongs to funplaylab.com, so your browser also sends it to other funplaylab.com sites; they do not use it.
- Game data: your SOF save (units, equipment, currency, progress), in-game mail, market listings and purchases, a log of currency changes, arena rank and recent PvP results, battle records, and your Leakproof and Hueless scores and replays.
- Technical data: your IP address is used briefly in memory to limit request rates, and appears in the web server's access log. The access log does not record query strings. The game service's own logs do not record IP addresses.
- Service providers: the pages are delivered by Cloudflare, which also stores our encrypted backups (Cloudflare R2), and the game server runs on Oracle Cloud. Both process technical data such as your IP address to deliver the service. Most pages also load Cloudflare Web Analytics, a page-view counter that sets no cookies and is not used to identify you.
Chat messages sent during a PvP match are passed to your opponent and are not stored. Some games also keep settings or unsent results in your own browser's storage; that stays on your device and you can clear it with your browser.
Why we use it
To sign you in, keep your progress, run fair rankings and leaderboards (we re-check scores on the server), operate the in-game market and mail, prevent abuse, and keep the service running and recoverable.
What other players can see
Your username, display name and avatar are shown next to your leaderboard entries, market listings and to your PvP opponents. Leaderboard replays can be viewed by other players.
How long we keep it
| Data | Kept for |
|---|---|
| Account and game data | Until you delete your account |
| Login sessions | Until logout, suspension or expiry; default 30 days, configurable by the operator |
| Login attempts in progress | 10 minutes |
| IP addresses for rate limiting | About 10 minutes, in memory only |
| Web server access log | Rotated daily and deleted after 30 days |
| Backups | Taken every five minutes. On the server: every copy for 2 hours, one per hour for 48 hours, one per day for 30 days; the newest verified copy is kept even if older. Encrypted off-site copies (Cloudflare R2): deleted 31 days after they were taken |
| Deletion ledger | Internal account ID, SHA-256 of provider/subject and deletion time are retained permanently to prevent restoration of deleted accounts. This is pseudonymous, not anonymous |
Your choices: export and delete
While signed in you can download everything we store about your account as a JSON file, and you can permanently delete your account.
Deleting your account removes your save, mail, market listings that have not sold, currency log, arena profile, battle records, scores and replays, and signs you out everywhere. A few records are shared with other players: a market sale (the buyer's purchase) and PvP matches (your opponent's result). Those are kept without your name, avatar or provider identity so the other player's history stays correct; your name in their match history is replaced by "deleted player". If you sign in again later, you start a new, empty account.
Backup copies are not edited. With continuing successful backups, old local copies normally age out within the default 30-day window; the newest verified backup is never automatically discarded, so a backup failure can extend that period. Encrypted off-site copies are deleted 31 days after they were taken, and access-log entries after 30 days. Restoring an older snapshot requires the current deletion ledger before service resumes; if that ledger is lost, outstanding requests must be reconciled before restoring service.
Your account
You are not signed in. Sign in to export or delete your data.
Signed in as .
Changes
We will update this page when our practices change and show the date of the last change here. Last updated: 18 October 2026.